Morrisons faces payout over leak of staff pay data

The High Court judgment that the company was "Vicariously liable" and therefore a claim should go ahead sets a precedent for businesses who hold data on their staff, lawyers said. The test case was the first class action over a data leak. "The judge found that Morrisons was not at fault in the way it protected colleagues' data but he did find that the law holds us responsible for the actions of that former employee, whose criminal actions were targeted at the company and our colleagues," it said. The judge cleared Morrisons of primary liability and ruled that it had not breached data protection principles, "Save in one respect which was not causative of any loss". Tony Pepper, chief executive of data security company Egress, said: "This is a warning to all organisations: not only are you completely responsible for the data you hold but you also need to control the way your employees access and handle this data. You need to start mitigating for the unpredictable human element."